du-recharge[.]icu

Analysis of du-recharge.icu indicates a generic phishing domain targeting users of mobile payment or recharge services. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited and resolved to the IP address 46.19.65.88, hosted on AS9123 (JSC TIMEWEB) in Russia. As of the report date, the domain is offline, though it previously appeared on one security blocklist (PhishDestroy) and was flagged by 7 of 95 security vendors on VirusTotal.

No SSL certificate was detected, and the domain used nameservers a.dnspod.com, b.dnspod.com, and c.dnspod.com, which are commonly associated with bulletproof or low-reputation hosting infrastructure. The exact nature of the phishing content remains unconfirmed, as no page title or brand-specific evidence was provided in the available data. However, the domain name suggests an attempt to impersonate a mobile recharge or payment portal, potentially tricking users into entering credentials or financial details.

Defenders should treat this domain as high-risk due to its blocklist presence, lack of SSL, and association with a hosting provider frequently used for malicious activity. Monitoring for re-activation or similar domains under the same registrar or nameserver set is recommended. No additional details about the phishing kit, targeted brand, or specific scam mechanics are available at this time.